<!--
  This file is a part of the open-eBackup project.
  This Source Code Form is subject to the terms of the Mozilla Public License, v. 2.0.
  If a copy of the MPL was not distributed with this file, You can obtain one at
  http://mozilla.org/MPL/2.0/.
  
  Copyright (c) [2024] Huawei Technologies Co.,Ltd.
  
  THIS SOFTWARE IS PROVIDED ON AN "AS IS" BASIS, WITHOUT WARRANTIES OF ANY KIND,
  EITHER EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO NON-INFRINGEMENT,
  MERCHANTABILITY OR FIT FOR A PARTICULAR PURPOSE.
  -->

<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html lang="en-us" xml:lang="en-us">
 <head>
  <meta http-equiv="Content-Type" content="text/html; charset=utf-8">
  <meta http-equiv="X-UA-Compatible" content="IE=edge">
  <meta name="DC.Type" content="topic">
  <meta name="DC.Title" content="Enabling Intelligent Ransomware Detection">
  <meta name="product" content="">
  <meta name="DC.Relation" scheme="URI" content="en-us_topic_0000002079002573.html">
  <meta name="prodname" content="">
  <meta name="version" content="">
  <meta name="brand" content="Online Help for Ransomware Protection-Dorado V700R001C00">
  <meta name="DC.Publisher" content="20241119">
  <meta name="DC.Format" content="XHTML">
  <meta name="DC.Identifier" content="EN-US_TOPIC_0000002079002589">
  <meta name="DC.Language" content="en-us">
  <link rel="stylesheet" type="text/css" href="public_sys-resources/commonltr.css">
  <title>Enabling Intelligent Ransomware Detection</title>
 </head>
 <body style="clear:both; padding-left:10px; padding-top:5px; padding-right:5px; padding-bottom:5px">
  <a name="EN-US_TOPIC_0000002079002589"></a><a name="EN-US_TOPIC_0000002079002589"></a>
  <h1 class="topictitle1">Enabling Intelligent Ransomware Detection</h1>
  <div id="body0000001282909078">
   <p id="EN-US_TOPIC_0000002079002589__p8060118">The system detects known ransomware attack signatures to identify whether file systems or LUNs are infected by ransomware. If no ransomware infection is identified, the system analyzes and compares file system or LUN snapshot changes, and uses machine learning algorithms to further check whether the file systems or LUNs are infected by ransomware. This section describes how to enable intelligent ransomware detection.</p>
   <div class="section" id="EN-US_TOPIC_0000002079002589__section17802133125417">
    <h4 class="sectiontitle">Precautions</h4>
    <p id="EN-US_TOPIC_0000002079002589__p57622222314">During intelligent ransomware detection, if the file system or LUN snapshot directory corresponding to the ransomware detection snapshot being checked is invisible, the system will create a clone file system or a clone LUN whose name starts with <strong id="EN-US_TOPIC_0000002079002589__b15207103210328">DEE-ANTI-CLONE</strong> based on the ransomware detection snapshot to generate metadata features of the snapshot. During the detection, do not delete or rename the clone file system or clone LUN whose name starts with this prefix. Otherwise, the detection may fail. After the intelligent ransomware detection, the system automatically deletes the clone file system or clone LUN whose name starts with this prefix.</p>
   </div>
   <div class="section" id="EN-US_TOPIC_0000002079002589__section1487541317382">
    <h4 class="sectiontitle">Procedure</h4>
    <ol id="EN-US_TOPIC_0000002079002589__ol13790921131411">
     <li id="EN-US_TOPIC_0000002079002589__en-us_topic_0000001166366216_en-us_topic_0000001091431193_li1570821013536"><span>On the navigation pane, choose <strong id="EN-US_TOPIC_0000002079002589__b176248109694154">Data Security</strong> &gt; <strong id="EN-US_TOPIC_0000002079002589__b127775884894154">Ransomware Protection</strong> &gt; <strong id="EN-US_TOPIC_0000002079002589__b201364447694154">Ransomware Detection Settings</strong>.</span></li>
     <li id="EN-US_TOPIC_0000002079002589__li5362122616287"><span>On the <span class="uicontrol" id="EN-US_TOPIC_0000002079002589__uicontrol3749165891620"><b>NAS Ransomware Detection</b></span> or <span class="uicontrol" id="EN-US_TOPIC_0000002079002589__uicontrol5561202805811"><b>SAN Ransomware Detection</b></span> tab page, select the vStore or LUN for which you want to enable intelligent ransomware detection and choose <strong id="EN-US_TOPIC_0000002079002589__b373195010220">More</strong> &gt; <strong id="EN-US_TOPIC_0000002079002589__b14431183395617">Enable Intelligent Ransomware Detection</strong>. After intelligent ransomware detection is enabled, you need to create a ransomware detection snapshot by following the instructions in <a href="en-us_topic_0000002079043893.html">Creating a Ransomware Detection Snapshot</a>. After the snapshot is generated, the system immediately performs ransomware detection on the snapshot.</span><p></p>
      <div class="note" id="EN-US_TOPIC_0000002079002589__note751754763520">
       <img src="public_sys-resources/note_3.0-en-us.png"><span class="notetitle"> </span>
       <div class="notebody">
        <ul id="EN-US_TOPIC_0000002079002589__ul169632023112316">
         <li id="EN-US_TOPIC_0000002079002589__li78251254173914">You can also select multiple vStores or LUNs for which you want to enable intelligent ransomware detection and click <span class="menucascade" id="EN-US_TOPIC_0000002079002589__menucascade9651115518235"><b><span class="uicontrol" id="EN-US_TOPIC_0000002079002589__uicontrol265119550232">Enable Intelligent Ransomware Detection</span></b></span> above the list.</li>
         <li id="EN-US_TOPIC_0000002079002589__en-us_topic_0000001282909078_li1963132314231">If intelligent ransomware detection is not required, locate the row that contains the vStore or LUN for which you want to disable intelligent ransomware detection, and choose <strong id="EN-US_TOPIC_0000002079002589__b12282939182219">More</strong> &gt; <strong id="EN-US_TOPIC_0000002079002589__b1128211392227">Disable Intelligent Ransomware Detection</strong>. Alternatively, select multiple vStores or LUNs for which you want to disable intelligent ransomware detection and choose <strong id="EN-US_TOPIC_0000002079002589__b20817119102411">More</strong> &gt; <strong id="EN-US_TOPIC_0000002079002589__b9817219192415">Disable Intelligent Ransomware Detection</strong> above the vStore list.</li>
        </ul>
       </div>
      </div> <p></p></li>
    </ol>
   </div>
  </div>
  <div>
   <div class="familylinks">
    <div class="parentlink">
     <strong>Parent topic:</strong> <a href="en-us_topic_0000002079002573.html">Using Intelligent Ransomware Detection</a>
    </div>
   </div>
  </div>
 </body>
</html>